To enable auditing of all local login events, which Advanced Audit Policy needs to be activated?

To enable auditing of all local login events, which Advanced Audit Policy needs to be activated?

• A. Logon/Logoff
• B. Account Logon
• C. System
• D. Privilege Use

Answer: (B)

Activating the Account Logon policy is essential for auditing local login events, as this policy specifically pertains to the actions related to user authentication at the computer level. When this policy is enabled, it tracks all events associated with logon activities, providing insights into who accessed the system and when, whether through a local account or domain credentials. This auditing capability is critical for security analysis and compliance monitoring. It allows administrators to review login attempts, whether successful or unsuccessful, thereby identifying potential unauthorized access or security breaches. By focusing on the Account Logon policy, organizations can maintain a comprehensive overview of user access to systems, which is vital for safeguarding sensitive information. Other options are more general or focus on different aspects of security. The Logon/Logoff category pertains to a broader range of logon sessions but does not specifically isolate the local login events in the way the Account Logon policy does. The System policy covers broader system events, while the Privilege Use policy focuses on specific use of privileges rather than authentication events. Thus, the specificity and focus of the Account Logon policy make it the appropriate choice for auditing local logins.

Activating the Account Logon policy is essential for auditing local login events, as this policy specifically pertains to the actions related to user authentication at the computer level. When this policy is enabled, it tracks all events associated with logon activities, providing insights into who accessed the system and when, whether through a local account or domain credentials.

This auditing capability is critical for security analysis and compliance monitoring. It allows administrators to review login attempts, whether successful or unsuccessful, thereby identifying potential unauthorized access or security breaches. By focusing on the Account Logon policy, organizations can maintain a comprehensive overview of user access to systems, which is vital for safeguarding sensitive information.

Other options are more general or focus on different aspects of security. The Logon/Logoff category pertains to a broader range of logon sessions but does not specifically isolate the local login events in the way the Account Logon policy does. The System policy covers broader system events, while the Privilege Use policy focuses on specific use of privileges rather than authentication events. Thus, the specificity and focus of the Account Logon policy make it the appropriate choice for auditing local logins.